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DETAILED ACTION 

1 . Claims 1-20 have been presented for examination. 

Specification 

2. The use of the trademark Microsoft has been noted on page 2 of this application. It 
should be capitalized wherever it appears and be accompanied by the generic terminology. 

3. Although the use of trademarks is permissible in patent applications, the proprietary 
nature of the marks should be respected and every effort made to prevent their use in any manner 
which might adversely affect their validity as trademarks. 

Claim Rejections - 35 USC § 112 

4. The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

5. Claims 1-20 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply with 
the enablement requirement. The claims contains subject matter which was not described in the 
specification in such a way as to enable one skilled in the art to which it pertains, or with which 
it is most nearly connected, to make and/or use the invention. The standard for determining 
whether the specification meets the enablement requirement was postured in the question, is the 
experimentation need to practice the invention undue or unreasonable? See MPEP § 2164.01; 
see Mineral Separation v. Hyde, 242 U.S. 261, 270 (1916); see In re Wands, 858 F.2d at 737, 8 
USPQ2d at 1404 (Fed. Cir. 1998); see also United States v. Telectronics, Inc., 857 F.2d 778, 785, 
8 USPQ2d 1217, 1223 (Fed. Cir. 1988). The Examiner has determined that it is unclear how the 
claimed invention would be made and/or used, and therefore requires undue experimentation. 
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Claim Rejections - 35 USC § 102 

6. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described -in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

7. Claims 1-6, 13, and 14 are rejected under 35 U.S.C. 102(e) as being anticipated by U.S. 
Patent Application Publication No. 2004/0019786 to Zorn et al., hereinafter Zorn. 

8. As per claim 1, Zorn teaches a method for automatically generating a credential database, 
comprising the following steps: 

connecting at least one client device to a network (Figures 1 A-1C, 2 [blocks 106]) having 
an authentication server (Figures 1A-1C, 2 [blocks 1 10]); 

generating credential data by the at least one client device (paragraphs 0037, 0051, i.e. 
client entering username and password); 

sending the credential data to the authentication server (paragraphs 0037, 0051, i.e. 
transmitting the username to the authentication server via an access point); and 

adding the credential data to a database of credential data (Figures 1 A-1C [blocks 1 12], 2 
[block 216], 8, 9, paragraphs 0127-0136, i.e. password preprocessing needs to be performed so 
the same initial word is used to generate subsequent authentication codes). The accounts server 
stores the username and passwords in a database and information has to be obtained from the 
client device at some point prior to the first authentication attempt. 
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9. Regarding claims 2, 12, and 1 8, Zorn teaches placing the authentication server into 
autolearn or logging mode before the credential data is sent (Figures 8, 9, paragraphs 0127-0136, 
i.e. preprocessing mode); and 

returning the authentication server to normal mode after the credential data is added to 
the database (Figures 3, 5A, 5B, 6A, 6B, paragraphs 0051-0054, 0069-0084, i.e. authentication 
mode). 

10. With regards to claims 3 and 9, Zorn teaches wherein the credential data is sent in a 
secure environment (Figure 3 [block 308], paragraph 0051). 

1 1 . Concerning claims 4 and 10, Zorn teaches wherein the credential data is encrypted before 
it is sent to the authentication server (Figure 3 [block 308], paragraph 0051). 

12. Concerning claims 5 and 1 1, Zorn teaches wherein the authentication server (Figures 1 A- 
1C, 2 [blocks 1 10]) and the at least one client device (Figures 1A-1C, 2 [blocks 106]) are in a 
physically secure location when the data is sent (paragraphs 0034-0036, i.e. using various 
authentication protocols to prevent attacks, such as the man-in-the-middle attack). 

13. Concerning claim 6, Zorn teaches the additional step of verifying the at least one device 
is authorized to access the network (paragraph 0039). 
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14. With regards to claims 13 and 15, Zorn teaches wherein the credential data is sent by a 
wireless communication link (Figures 1A-1B, 2 [element 104]). 

1 5. With regards to claim 14 and 16, Zorn teaches wherein the credential data is sent by a 
hard-wired communication link (Figure 1C [element 108]). 

Claim Rejections - 35 USC § 103 

1 6. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

17. Claims 7 and 19 are rejected under 35 U.S.C. 103(a) as being unpatentable over Zorn in 
view of U.S. Patent Application Publication No. 2002/0007462 to Omata, hereinafter Omata. 

18. Concerning claim 7, Zorn does not teach the additional step of deleting credential data for 
any unauthorized devices. 

1 9. Omata discloses the step of deleting credential data (Figure 2 [step Sill], paragraph 
0017). 

20. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to delete the credential data for any unauthorized devices, since Omata states at 
paragraph 0017 that by deleting the credential data for any devices that are unauthorized prevents 
unauthorized logins which in turn prevents malicious users and abuse of the system. 
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21. With regards to claim 19, Zorn teaches the additional steps of verifying the client devices 
are authorized to access the network (paragraph 0039). 

22. Zorn does not teach deleting the credential data for any unauthorized client devices. 

23. Omata discloses deleting the credential data (Figure 2 [step Sill], paragraph 0017). 

24. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to delete the credential data for any unauthorized devices, since Omata states at 
paragraph 0017 that by deleting the credential data for any devices that are unauthorized prevents 
unauthorized logins which in turn prevents malicious users and abuse of the system. 

25. Claims 8-12, 15-18, and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Zorn. 

26. Regarding claims 8 and 20, Zorn teaches the additional steps of verifying the at least one 
device is authorized to access the network (paragraph 0039). 

27. Zorn does not teach verifying the device before the credential data is added to the 
database. 

28. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to verify the device before the credential data is added to the database, since one of 
ordinary skill in the art would recognize that it would be a waste of time and memory to add a 
device's credentials to the database if it did was not authorized to access the network. 

29. As per claim 17, Zorn teaches a method for automatically generating a credential 
database for a plurality of client devices, comprising the steps of: 
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connecting a client device to a network (Figures 1 A-1C, 2 [blocks 106]) having an 
authentication server (Figures 1A-1C, 2 [blocks 1 10]); 

generating credential data by the client device (paragraphs 0037, 0051, i.e. client entering 
username and password); 

sending the credential data to the authentication server (paragraphs 0037, 0051, i.e. 
transmitting the username to the authentication server via an access point); 

adding the credential data to a database of credential data (Figures 1 A-1C [blocks 1 12], 2 
[block 216], 8, 9, paragraphs 0127-0136, i.e. password preprocessing needs to be performed so 
the same initial word is used to generate subsequent authentication codes). The accounts server 
stores the username and passwords in a database and information has to be obtained from the 
client device at some point prior to the first authentication attempt. 

30. Zorn does not disclose repeating the steps until the credential data for the plurality of 
client devices has been added to the database. 

31. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to repeat the steps of adding user credential information to a database, since it has 
been held that it that it only requires routine skill in the art to replicate a step and that such 
replication has no patentable significance unless a new and unexpected result is produced. See 
MPEP § 2144.04; see also In re Harza, 274 F.2d 669, 124 USPQ 378 (CCPA 1960). 

Conclusion 

32. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 
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33. The following patents are cited to further show the state of the art with respect to client 
authorization information registration, such as: 

United States Patent Application Publication No. 2004/0208151 to Haverinen et al., 
which is cited to show 802. IX open system authentication. 

United States Patent Application Publication No. 2004/0236964 to Haverinen, which is 
cited to show registering the authentication information of a mobile device. 

United States Patent No. 6,061,791 to Moreau, which is cited to show registering a secret 
key for identity verification. 

United States Patent No. 5,875,394 to Daly et al., which is cited to show a subscriber 
activating account information via comparing a password to a registered password. 

United States Patent Application Publication No. 2002/0186688 to Inoue et al., which is 
cited to show authorizing a user based on the registered location of the client device. 

United States Patent No. 7,123,604 to Inoue et al., which is cited to show authorizing a 
user based on the registered location of the client device. 

United States Patent No. 6,891,819 to Inoue et al., which is cited to show authorizing a 
user based on the registered location of the client device. 

34. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christian La Forgia whose telephone number is (571) 272-3792. 
The examiner can normally be reached on Monday thru Thursday 7-5. 

35. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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36. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR - 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Christian LaForgi; 
Patent Examiner 
Art Unit 2131 
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